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— The MAILING DATE of this communication appears on the cover sheet with the correspondence address « 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any repty received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

I) S Responsive to communication(s) filed on 29 November 2004 . 
2a)l3 This action is FINAL. 2b)Q This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) S Claim(s) 1-22 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) S Claim(s) 1-22 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)Q The drawing(s) filed on is/are: a)Q accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

II) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)Q Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2.D Certified copies of the priority documents have been received in Application No. . 



3.Q Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



1. An amendment was received on 29 November 2004. Claims 1, 2, 8, 12-16, and 
20-22 have been amended. No claims have been added or canceled. Claims 1-22 are 
currently pending in the present application. 



Response to Arguments 



2. Applicant's arguments with respect to claims 1-22 have been considered but are 
moot in view of the new ground(s) of rejection. 

Claim Objections 

3. Claims 1 and 13 are objected to because of the following informalities: 

In Claims 1 and 13, in the limitation "incorporating, said encrypted address 
portion", the comma after "incorporating" should be deleted. 

In Claim 1, in the limitation "providing a key supporting decryption of said 
encrypted address portion, to a destination system", the comma after "portion" should 
be deleted. 

Appropriate correction is required. 
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Claim Rejections - 35 USC §112 

4. Claim 12 was rejected under 35 U.S.C. 112, first paragraph. It was noted in the 
previous Office action that the specification provided enabling written description for 
encryption using triple DES, but that the specification did not provide enabling written 
description of the claimed limitation of encryption using the RSA algorithm. The claim 
has been amended to recite encryption using the RSA MD5 algorithm. The 
specification does provide written description of the use of the MD5 algorithm; however, 
MD5 is a hashing algorithm and not an encryption algorithm. Therefore the claim is 
rejected under 35 U.S.C. 112, second paragraph, as set forth below. 

5. The rejection of Claim 2 under 35 U.S.C. 112, second paragraph, is withdrawn in 
light of the amendment to the claim. 

6. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

7. Claim 12 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

Specifically, Claim 12 recites the limitation "said link processor encrypts said 
address portion using an RSA (Rivest Shamir Adleman) MD5 compatible algorithm". 
However, it is unclear how one would encrypt using the MD5 algorithm, since MD5 is a 
hash function and not an encryption algorithm. This renders the claim indefinite. 
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Claim Rejections - 35 USC § 102 

8. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

9. Claims 1- are rejected under 35 U.S.C. 102(b) as being anticipated by 
Levergood, US Patent 5708780. 

In reference to Claim 1 , Levergood discloses a system that includes a link 
processor for identifying and encrypting an address portion of a URL (column 5, lines 
61-65; column 3, lines 34-37, noting that the SID includes an accessible domain that is 
included under the digital signature), incorporating the encrypted address portion with 
an unencrypted address portion into a URL (column 5, lines 52-54, where [SID] includes 
' the encrypted address portion), and providing a key allowing decryption to a destination 
system (column 5, lines 61-65, where the key is shared by the authentication and 
content servers). Levergood further discloses a communication processor for 
incorporating the URL into formatted data for communication to the destination system 
(see column 4, lines 1-6 and column 7, lines 15-21). 

In reference to Claims 2 and 3, Levergood further discloses adaptively identifying 
the address portion based on the application associated with the URL (see column 3, 
line 56-column 4, line 18, where a link is processed differently depending on whether it 
is within the same application or to a different application). 
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In reference to Claims 5 and 7, Levergood further discloses compressing the 
address portion with a hash function prior to encryption (column 5, lines 61-65). 

In reference to Claims 8 and 9, Levergood further discloses incorporating a 
session identifier into the URL by formatting the session identifier (column 5, lines 52-54, 
noting column 3, lines 12-16, where SID is a session identifier). 

In reference to Claims 10 and 1 1 , Levergood further discloses concatenating 
data associated with a personal record, specifically a user identifier, to the address 
portion to form a data element and encrypting the data element (column 3, lines 34-37, 
where the SID includes a user identifier and accessible domain included under the 
digital signature). 

In reference to Claim 13, Levergood discloses a system that includes a link 
processor for identifying and encrypting an address portion of a URL (column 5, lines 
61-65; column 3, lines 34-37, noting that the SID includes an accessible domain that is 
included under the digital signature) and incorporating the encrypted address portion 
with an unencrypted address portion and a session identifier into a URL (column 5, lines 
52-54, where [SID] includes the encrypted address portion, and column 3, lines 12-16, 
noting SID is a session identifier). Levergood further discloses a communication 
processor for incorporating the URL into formatted data for communication to the 
destination system (see column 4, lines 1-6 and column 7, lines 15-21). 



Application/Control Number: 09/817,320 Page 6 

Art Unit: 2137 

In reference to Claim 15, Levergood discloses a system that includes an input 
processor that receives an encoded URL, a link processor that processes the encoded 
URL by identifying encrypted and unencrypted address portions of the URL (column 5, 
lines 52-54, where [SID] includes the encrypted address portion) and decrypting the 
encrypted address portion, and a validation processor that determines if the address 
portion has been subject to unauthorized modification by determining if the decrypted 
portion is different from the unencrypted portion (see column 6, lines 5-16, where the 
digital signature is validated). 

In reference to Claim 16, Levergood further discloses applying a hash function to 
the unencrypted portion and comparing first and second hash values in which a match 
indicates successful validation (column 6, lines 5-16). 

In reference to Claim 17, Levergood further discloses identifying a session 
identifier in the received URL (column 5, lines 52-54, noting column 3, lines 12-16, 
where SID is a session identifier). 

In reference to Claims 18 and 19, Levergood further discloses that the URL 
includes data associated with a personal record, specifically a user identifier (column 3, 
lines 34-37, where the SID includes a user identifier and accessible domain included 
under the digital signature). 

Claim 20 is directed to a method that corresponds substantially to the system of 
Claim 1, and is rejected by a similar rationale. 
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Claims 21 and 22 are directed to methods that correspond substantially to the 
systems of Claims 15 and 16, and are rejected by a similar rationale. 

Claim Rejections - 35 USC § 103 

10. Claims 4, 6, and 14 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Levergood. 

In reference to Claim 4, Levergood discloses everything as applied above to 
Claim 3. However, Levergood does not explicitly disclose the use of Active Server 
Page (ASP) applications. Official notice is taken that it is well known to use scripting 
languages such as ASP, CGI, and Javascript to allow dynamic or changing content to 
be displayed as part of a web page. Therefore, it would have been obvious to one of 
ordinary skill in the art at the time the invention was made to modify the system of 
Levergood to include the use of ASP applications, in order to allow a wider variety of 
information to be presented through the use of dynamic web pages. 

In reference to Claim 6, Levergood discloses everything as applied above to 
Claim 5. In reference to Claim 14, Levergood discloses everything as applied above to 
Claim 13, and Levergood further discloses compressing the address portion before 
encryption (column 5, lines 61-65). However, Levergood does not explicitly disclose 
converting the address portion to lower case before compression. Official notice is 
taken that it is well known that addresses within URLs are case-insensitive, and that it is 
also well known that a hash function, by definition, will return a very different result if 
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even one bit of the input is changed. By extension, if an input character is changed 
from lowercase to uppercase, the output of a hash function will be different. Therefore, 
it would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the system of Levergood by including forcing all characters in the 
input to a hash function (namely the address portion) to lowercase, in order to insure 
that a comparison of hash function results will return the proper result. 



Conclusion 



1 1 . The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. Berman et al, US Patent 5995939, discloses a system that includes 
encrypting messages containing patient specific information. 

12. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
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shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Zachary A. Davis whose telephone number is (571 ) 272- 
3870. The examiner can normally be reached on weekdays 8:30-6:00, alternate 
Fridays off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on (571) 272-3868. The fax phone 
number for the organization where this application or proceeding is assigned is 703- 
872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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SUPERVISORY PATENT EXAMINER 
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